A tcp keep-alive ack packet is transmitted after a tcp keep-alive packet is received. WireShark usually analyzes and indicates both packets correctly. For example, #428 and #429. However, I guess sometimes WireShark's analysis regards a keep-alive ack packet as a window update packet. For example, look at #2286 which is supposed to be a keep-alive ack packet.
So, does anyone know how WireShark figues out a packet is TCP Keep-Alive ACK or TCP Window Update? or any difference between those two??? Thank you.
asked 25 Jun ‘13, 22:53
Your quote is missing a vital information, and that is the packet coming from B.ip of the second conversation before the packet with the Window Update. A Window Update is diagnosed when a TCP packet arrives that has the same sequence number as the last packet and it's only new information is a different window size than the previous packet did. Maybe that packet is also a keep alive ack, but I think only one expert message is shown per info row.
answered 26 Jun '13, 01:42